Security, Privacy and Compliance FAQsFollow
What type of personal data does Gong process?
This depends on your use case, what you connect with, and what you determine that Gong should ingest. At a high level, we collect video calls, phone conversations, email correspondence, meetings and calendar events, CRM data, and digital interaction data.
Gong may process personal data to provide services to customers. The types of personal data typically processed may include:
The name and business contact details of users and participants
Gong usage data and other technical data concerning the user’s usage, device and connectivity to Gong
Recorded communications which primarily concern the purchase or use of the company’s services
The analyses and insights generated based on such communications.
How does Gong uphold GDPR, CCPA, and other data protection regulations?
We satisfy GDPR/CCPA compliance through updated SCCs in our Data Processing Addendum. Gong takes a holistic approach to compliance and privacy in order to help customers comply with GDPR/CCPA. It's possible to record sales conversations in compliance with the right workflows.
Gong offers three features designed to help businesses comply with privacy regulations, including the Gong consent page, API and application tools to enforce the right to be forgotten, and permission profiles. These tools are also used internally by Gong to ensure we adhere to privacy regulations and our internal privacy program. Internally, Gong maintains a privacy program to ensure compliance with privacy regulations, and we are ISO 27701 and ISO 27018 certified.
How is data used in Gong?
Your organization owns the data ("controller" in GDPR parlance), and Gong processes it ("processor" in GDPR parlance) to provide the service.
Where is our data processed?
Gong holds offices in the United States, Israel, and Ireland, where data may be processed. In addition, Gong engages with sub-processors located in the United States, the UK, and EMEA.
How is our data protected?
Gong is SOC2 Type II compliant and provides a third-party attestation report covering security, availability, confidentiality, privacy, and HIPAA compliance (Mapping of HIPAA Security Requirements). Gong has a certification for compliance with ISO 27001, ISO 27017, ISO 27018, and ISO 27701. Gong is included in the Cloud Security Alliance’s (CSA’s) Security, Trust, Assurance, and Risk (STAR) Registry.
Gong’s compliance with this internationally-recognized standard and code of practice is evidence of our commitment to information security at every level of our organization. Our security program is in accordance with industry-leading best practices.
For more information on Gong’s security practices, please visit the Summary of security features section of Gong’s Help Center.